Here is what I do:

Type in all kinds of passwords in an excel file (.xlsx)

Zip it with a password by 7-zip

  • AES 256

  • length > 8

  • combination of A-Z a-z 0-9 symbols

  • different from any other password

Upload it to Dropbox or so.

Is it safe enough, as I do not want to install any additional software specifically for storing passwords? (I mean, if I insist no additional software, any safer ways?)

Be a little bit more specific:

Scenario 1:

Basically I guess no one will be interested in my passwords. Is it safe enough to prevent some casual attacks (for fun maybe) by hackers?

Scenario 2:

If the government is interested in me, and my computer may be taken, is it safe?


The guy asking this question is paranoid and quite lazy (to install additional software).

AES-256 (the encryption method used by 7-zip) is nice enough to prevent any casual attempts, according to Biglig, Randolf Richardson and MaQleod.

KeePass is recommended by pepoluan in case I am not that lazy. An extended list for password management can be found in a related question on this site: How do you keep track of all your passwords?, in which KeePass is the top voted.

TrueCrypt is recommended for encrytion by Darokthar.

For scenario 2 (the government thing), Rubber-hose cryptanalysis should not be underestimated (contributed by grawity).

The question is still open to better answers. No extra password-/encryption-specific software.

  • 2
    What are your attack scenarios, i.e. what do you want to protect against? Computer-illiterate siblings or foreign (or your own) governments? – Daniel Beck Mar 7 '11 at 7:05
  • @Daniel Beck I don't know. You can consider me as paranoid. I just want to feel safe generally. – user69835 Mar 7 '11 at 7:58
  • 1
    In case of scenario 2, never underestimate the effectiveness of rubber-hose cryptanalysis. – user1686 Mar 7 '11 at 10:45

I'd personally use KeePass.

Not only KeePass has a portable version (that you can run straight off of a UFD), it's a full-featured password database, with an 'auto-type' feature so no one need to see what your password is.

| improve this answer | |
  • I know KeePass, which is mentioned in another question in this site. I just wonder if I insist no additional software.... – user69835 Mar 7 '11 at 9:45
  • 1
    Hmmm... no additional software, eh? Well, when you un-encrypt your password file, you will probably use notepad to see its content someone can peek over your shoulder. Then you'd do a copy-paste some spyware/keylogger might be watching the clipboard. KeePass keeps your password hidden, plus it can bypass Ctrl-V loggers keepass.info/help/v2/autotype_obfuscation.html – pepoluan Mar 8 '11 at 10:36

7-zip uses AES-256, which is rated acceptable for TOP SECRET documents by the NSA.

Assuming you use a strong pass-phrase that should be more than enough to persuade the attacker not to bother with trying to crack the file, but to move on immediately to beating it out of you with a wrench.

| improve this answer | |
  • 3
    Ha ha! That comment about the wrench is hilarious. If this happens, I strongly recommend refraining from saying something like "Oh, hello Mr. Fix It!" – Randolf Richardson Mar 7 '11 at 11:44
  • 1
    7zip's AES is plenty for scenario one. – Biglig Mar 15 '11 at 16:08
  • Scenario 2, encryption strength is not the problem. Depends where you are, but in my juristicion the cops can put me in jail if I do not tell them my password. I don't think you can make something proof against the government and stay lazy. – Biglig Mar 15 '11 at 16:14

If AES-256 encryption is safe enough, then 7-Zip will do that. It also provides an additional option to encrypt the filenames. If you're encrypting your data, you should probably encrypt the filenames, too.

| improve this answer | |
  • Actually, I just name the file as homework or so.... – user69835 Mar 7 '11 at 9:43
  • @Nate Bross, or so. I am not that stupid.... – user69835 Mar 8 '11 at 1:13

It depends on your .zip Program if the encryption is secure. I would suggest using Truecrypt instead. You could create a encrypted file and store your excel file in it. For passwords I'd think it is better to have strong passwords and write them down, than using weak passwords. As long as your system is not compromised and you are using a strong password for your Truecrypt file it should be pretty safe. But i would save no online banking data in it.

If your system is compromised by a key logger it might even be better to use stored passwords than hacking them in with the keyboard. But i only would use the Truecrypt file in the dropbox for backup reasons. I don't know if dropbox uses a secure connection, if they don't the password and the file could be sniffed by an attacker. Especially if you are using WiFi HotSpots or a shared network.

Daniel Beck is right, too. You have to consider the attack scenario. If you are working for a company and have secret data it might not be a good solution, but for a normal user it is quite ok. You should change your passwords regularly though. Maybe every month or every two month. Just to be sure.

| improve this answer | |
  • I do not know about Truecrypt. 7-zip uses AES-256. To what extent is it weaker than Truecrypt? – user69835 Mar 7 '11 at 9:42
  • Dropbox uses HTTPS for sync. – user69835 Mar 7 '11 at 9:43
  • @Dante Jiang If Dropbox uses https this should be safe as long as both sides are not compromised (Your box and the Dropbox server). Truecrypt is an encryption program. You could basically encrypt any file with it, by putting the file in Truecrypt container. Afterwards you can mount the file like an device (it becomes LETTER: in windows explorer). Then you can open the encrypted files normal. With Truecrypt you could select which algorithm to use and you can put encrypted files in encrypted files. Furthermore you could use certificates as encryption passwords (If you are paranoid). – Darokthar Mar 7 '11 at 15:18

Safe-enough is relative, but generally speaking, it would not be considered secure at all and would not be advisable.

| improve this answer | |
  • 2
    AES 256 is good, it will prevent the average user from attempting anything. If the passphrase is strong enough then you shouldn't have to worry about even more advanced attacks. I just don't agree with storing passwords on a third party service, regardless of the encryption used. – MaQleod Mar 7 '11 at 9:48